Resources

Learn Center
Demos, Training & Certifications

Everything you need to train and certify on Palo Alto Networks solutions — the complete 12-plan Demo Zone catalog with unlock requirements, 22 AI Role Play simulations, and the current four-level certification framework that replaced the retired PCNSE-era exams. Ready to demo right now? Jump to the Demo Launch Pad for one-click tenant launchers.

Live Demo

XSIAM SE Demo Environment

Access the live XSIAM demo environment for hands-on exploration and customer presentations. Current platform release is XSIAM 3.6 (July 20, 2026).

XSIAM SE Demo

Live Environment

Full-featured XSIAM 3.6 demo instance pre-loaded with sample data, incidents, playbooks, and analytics. Use for whiteboard sessions, customer demos, and self-learning. Demo the 3.6 additions: Frontier AI model choice, Cortex XTI threat intelligence, and natural-language dashboards.

Launch Demo Environment

Training

Palo's Training — Demo Zone (Learning Center)

The complete Demo Zone for Partners catalog (login required) — 12 learning plans across Network Security and Security Operations, verified August 19, 2026. Each plan takes about an hour and its mandatory sub-courses must be completed to unlock demo system access — cover the material, then launch the environment. The Identity Security tab exists but currently has no published plans. Once you've built demo proficiency, rehearse the pitch in the AI Role Plays.

AI Podium is live for Cortex AES (Koi) — practice your demo pitch with real-time AI feedback inside the demo system. Dedicated AI Podiums for Quantum, NGTS, and AIRS are coming soon. Intro videos: Demo Zone overview · AI Podium overview.

Network Security — 6 Learning Plans

Demo Zone: PAN-OS / Panorama
Deliver PAN-OS and Panorama demos showcasing Strata Cloud Manager visibility for NGFW and Prisma Access deployments, with Panorama included for legacy needs. 6 courses, ~1 hr. Required to unlock the demo: Unlock Demo System Access, PAN-OS/Panorama Demo Resources, Access the Demo. Free.
Start Learning
Demo Zone: SASE Security
Prisma Access and Prisma SD-WAN design-and-demo training. 4 courses, ~1 hr: Prisma Access Design & Demo (25m), Prisma SD-WAN Design & Demo (35m), then the mandatory Access SASE Demos course unlocks the environments. Free.
Start Learning
Demo Zone: Prisma Browser
High-impact Prisma Browser demos with access to the SCM Prisma Browser admin portal plus a recorded day-in-the-life user demo. 5 courses, ~1 hr. Mandatory: Unlock Demo System Access, Demo Video & Resources, Access Prisma Browser Demo. Free.
Start Learning
Demo Zone: Prisma AIRS
Showcase Prisma AIRS (AI Runtime Security) across the AI ecosystem — apps, models, data, and agents — with real-time threat prevention, risk assessment, and posture demos. 6 courses, ~1 hr. Mandatory: Demo Resources, Unlock Demo System Access, Access the Demo.
Start Learning
Demo Zone: NGTS New
Next-Generation Trust Security — automated certificate management and SaaS-based private PKI orchestration, from overview training to the dedicated NGTS demo environment. 5 courses, ~1 hr. Mandatory: Demo Guide & Video, Unlock Demo System Access, Access the NGTS Demo. Free.
Start Learning
Demo Zone: Device Security
ML-based asset discovery and risk prioritization across IT, IoT, and industrial OT environments, from overview to hands-on demo. 5 courses, ~1 hr. Mandatory: Demo System Resources, Unlock Demo System Access, Access the Device Security Demo System.
Start Learning

Security Operations — 6 Learning Plans

Demo Zone: Cortex XSIAM
The essential framework for preparing and delivering effective Cortex XSIAM demonstrations. 4 courses, ~1 hr: XSIAM Design & Demo (30m), then mandatory XSIAM Demo Resources (30m) and Access the Cortex XSIAM Demo System. Validate against the XSIAM 3.6 UI before customer-facing use.
Start Learning
Demo Zone: Cortex XDR
Lead professional Cortex XDR demonstrations with a full XDR environment (Cortex XDR 5.2). 5 courses, ~1 hr. Mandatory: Unlock Demo System Access, XDR Demo Resources (30m), Access the Cortex XDR Demo System. Note the XDR 5.x packaging when demoing.
Start Learning
Demo Zone: Cortex AES (Koi) AI Podium
Core Cortex AES (Koi) capabilities for protecting AI-driven developer and agentic endpoint environments — and the only demo system with live AI Podium pitch practice. 6 courses, ~1 hr. Mandatory: Unlock Demo System Access, Access the Cortex AES (Koi) Demo System.
Start Learning
Demo Zone: Cortex AgentiX New
Prepare and deliver Cortex AgentiX demos (AgentiX 1.4) — AI-driven operations, centralized data, faster detection and response, and the MCP-based agent interoperability framework. 4 courses, ~1 hr. Mandatory: Demo Resources (27m), Access the Cortex AgentiX Demo System. Free.
Start Learning
Demo Zone: Cortex Cloud C3
The unified cloud security platform vision — purpose-built workflows unlocking collaboration between Cloud Security and SecOps teams (Cortex Cloud 2.2). 5 courses, ~1 hr. Mandatory: Unlock Demo System Access, Cortex Cloud Demo Resources (27m), Access the Cortex Cloud Demo System.
Start Learning
Demo Zone: Cortex Advanced Email Security
Ten "Side Quests" through the Email Command Center — multi-source email detections, email cases, riskiest-user investigation, onboarding, and remediation from one-click Quick Actions to Custom Playbooks with automation rules. 6 courses, ~1 hr. Mandatory: Unlock Demo System Access, Demo Resources, Access the Demo System. Free.
Start Learning

Related Demo Training (Outside the Demo Zone Catalog)

XSIAM Demo in 5 Minutes
Quick-hit XSIAM demo walkthrough. Perfect for preparing a concise executive-level demo or refreshing your demo skills before a customer meeting.
Start Learning
Cortex Xpanse Design & Demo
Attack surface management demo training on Cortex Xpanse Expander 2.14 — internet-facing asset discovery, vulnerability identification, and exposure management. Not listed in the Demo Zone tabs but still an active learning plan.
Start Learning
AI Role Plays for Partners 22 Simulations
Pressure-test your pitch against dynamic AI buyer personas — discovery calls, competitive displacements, cold calls, and ELA discussions across the full portfolio. Cover the Demo Zone material above first, then rehearse here.
Browse Role Plays

Certifications

Core XSIAM Certifications

XSIAM Engineer and XSIAM Analyst both sit at the Specialist level of the current certification framework. They validate your ability to implement, operate, and analyze with XSIAM. Browse every credential on the official certification portal or grab the certification handbook (PDF).

XSIAM Engineer

Most Important

Covers: Deployment, Data onboarding, Playbooks, Detection engineering

Purpose: Validates ability to implement and operate XSIAM

Required for partners delivering: XSIAM onboarding, Health checks, Managed SOC

Level: Specialist — alongside XSIAM Analyst and Next-Generation Firewall Engineer

Official XSIAM Engineer Certification Path Prep Course: XSIAM Security Operations, Integration & Automation (3-day ILT)

XSIAM Analyst

Focus: Incident response, Alert handling, Threat hunting

Purpose: Validates SOC analyst skills using XSIAM

Required for: SOC teams, MSSP analysts, Detection validation

Level: Specialist

Official XSIAM Analyst Certification Path
Certification Priority: Start with XSIAM Engineer — it's the foundation certification required for all XSIAM delivery work. XSIAM Analyst builds on top of that foundation with SOC-specific skills. Both are Specialist-level credentials in the framework below; there is no identity or AI certification yet.

Credentials

The Current Certification Framework

The PCNSE-era exam family is retired. Palo Alto Networks certification is now four levels across three tracks — use these names in customer and partner conversations.

Retired — do not reference these exams: The entire PCNSA, PCNSE, PCSAE, PCCSE, PCSFE, PCCET and PCDRA family is retired. PCNSE, PCCSE and PCSAE ended on July 31, 2025. If a customer, partner or job spec still asks for PCNSE, map them to the equivalent level below.

Level 1 — Cybersecurity Apprentice

Entry credential. The starting point for new-to-security staff and for partner teams building bench depth.

Browse Paths on the Certification Portal

Level 2 — Cybersecurity Practitioner

Hands-on operator credential, sitting between Apprentice and the track-specific Professional exams.

Official Cybersecurity Practitioner Path

Level 3 — Professional (3 tracks)

Network Security Professional — the successor conversation for anyone who says "PCNSE"

Security Operations Professional — the SOC and Cortex track

Cloud Security Professional — the Cortex Cloud and Prisma Cloud track

Naming note: this level was called "Generalist" until it was renamed "Professional" in May 2025

Official Network Security Professional Path

Level 4 — Specialist, then Architect

Specialist: XSIAM Analyst, XSIAM Engineer, Next-Generation Firewall Engineer

Architect: the top level of the framework

Gap to flag: no identity certification and no AI certification exists yet — do not promise one for Idira or Prisma AIRS

XSIAM Engineer Path XSIAM Analyst Path NGFW Engineer Path